linux-kernel - Re: [External] : Re: CVE-2023-52628: netfilter: nftables: exthdr: fix 4-byte stack OOB write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a059d0a56078b369a78cccbe60e5d538c61d76d8.camel@oracle.com>
Date: Tue, 9 Jul 2024 11:44:21 +0000
From: Siddh Raman Pant <siddh.raman.pant@...cle.com>
To: "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC: "cve@...nel.org" <cve@...nel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: Re: [External] : Re: CVE-2023-52628: netfilter: nftables: exthdr: fix
 4-byte stack OOB write

On Tue, Jul 09 2024 at 15:39:43 +0530, gregkh@...uxfoundation.org wrote:
> Looks like Red Hat created it and then rejected it, you will have to
> talk about this with them.  But then later ZDI asked me to assign a CVE
> for it, and I did assuming that they knew what they were talking about.
> I shouldn't have assumed that :(
> 
> I don't know what to do here, sorry.  If you don't think this is an
> issue, great, I'll be glad to reject it but we should say at least why
> we don't think so here in this thread, right?

Thank you for the clarification!

I thought the "Linux kernel security team" is referring to an upstream
group, so I asked about it because it seemed off.

Anyways, best to have this up instead of not.

Thanks,
Siddh

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)